huntrule

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

FreeReviewedSigma · Critical · v2
Product
windows
Category
file_event
Author
Florian Roth (Nextron Systems), David ANDRE (SigmaHQ), DRL 1.1
Published
2021-11-08
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows file creation events where the target filename ends with artifacts associated with Mimikatz, including Kerberos ticket files (.kirbi) and MemSSP log output (mimilsa.log). Attackers may generate these files during credential access workflows, making them useful indicators of credential tooling on the host. It relies on file event telemetry that includes the created or written filename via a target filename field.

Reporting behind it

Related detections8 linkedT1558 — drag to rearrange
Malicious Kerberos proxiable/S4U2self Ticket - CVE-2021-42278/42287 (via security)
Malicious Rubeus Kerberos Unconstrained Delegation Abuse (via security)
Malicious Rubeus Kerberos Constrained Delegation Abuse - S4U2Proxy (via security)
Renamed Mimikatz Credential Theft Command Indicators (via process_creation)
Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties
Windows Kerberos Replay Attack Likely Activity on Domain Controllers (Event ID 4649)
Windows: Uncommon Outbound Kerberos Traffic on Port 88
Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)
Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation
Pivot detection · T1558 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.